CVE-2026-109976
Received Received - Intake

Integer Underflow in Clevis PKCS#11 Pin Causes DoS

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: redhat-SADP

Description
A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client connects to the data socket without a bound address, due to an integer underflow in the getpeername result handling. This causes a denial of service, preventing LUKS disk decryption from completing during boot.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109976
EUVD
EUVD-2026-98481

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Red Hat Red Hat Enterprise Linux 10 *
Red Hat Red Hat Enterprise Linux 7 *
Red Hat Red Hat Enterprise Linux 8 *
Red Hat Red Hat Enterprise Linux 9 *
Red Hat Red Hat OpenShift Container Platform 4 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109976 is a flaw in the clevis PKCS#11 pin component where the clevis-pkcs11-afunix-socket-unlock daemon crashes due to an integer underflow when handling an AF_UNIX client connection without a bound address. This crash occurs during getpeername result handling, causing a denial of service that prevents LUKS disk decryption during system boot.

Detection Guidance

Check if the clevis-pkcs11-afunix-socket-unlock daemon is running and monitor for crashes during boot. Examine system logs for daemon aborts or buffer overflow errors. Verify socket permissions under /run/clevis or similar paths. Use commands like 'systemctl status clevis-pkcs11-afunix-socket-unlock' or 'journalctl -u clevis-pkcs11-afunix-socket-unlock' to detect crashes.

Impact Analysis

This vulnerability can cause a denial of service by crashing the daemon during system boot, preventing LUKS disk decryption from completing. It requires specific configuration to be exploitable, such as PKCS#11 clevis pin setup with hardware support and activated systemd service or dracut module. Default installations are not affected due to restrictive socket permissions.

Mitigation Strategies

No immediate action is required for most users as default configurations are safe. Ensure the daemon runs with restrictive socket permissions (mode 0755) and systemd UMask 0022. Update clevis packages if a fix is available. Avoid custom configurations that enable hardware-backed PKCS#11 pins unless necessary.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109976. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart